What’s Vulnerable › Vulnerabilities

CVE-2026-57132: PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication

• Severity: high (CVSS 8.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-14 · updated 2026-09-16
• Weakness: CWE-287

Description

PraisonAI is a multi-agent teams system. Prior to 4.6.62, setting PRAISONAI_CALL_AUTH to disabled makes verify_token accept requests to /api/v1/agents/{id}/invoke without CALL_SERVER_TOKEN authentication. Deployments that use the application's advertised opt-out can expose registered agents and their connected tools or private context to unauthenticated invocation. The vulnerability is fixed in 4.6.62.

Affected products

• MervinPraison PraisonAI: before 4.6.62

References

• https://github.com/MervinPraison/PraisonAI/commit/2a855c470077c7d2e2479a575f7ef7f548d51c33
• https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.62
• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8ccj-p46r-jwqq
• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8ccj-p46r-jwqq

Get alerted when CVE-2026-57132 or the next vulnerability affects your stack